MediumGHSA-xm6j-x342-gwq9CVE-2019-16409

SilverStripe Versioned Files module Unpublished files are exposed publicly

Published 12 Nov 2019 · Updated 17 Feb 2024

Affected packages

symbiote/silverstripe-versionedfilesComposer

Affected: <=2.0.3
Fixed in: No fix released

silverstripe/frameworkComposer

Affected: >=4.0.0 <4.3.5
Fixed in: 4.3.5

Update to the fixed version for your release line, for example:composer require silverstripe/framework:^4.3.5

silverstripe/frameworkComposer

Affected: >=4.4.0 <4.4.4
Fixed in: 4.4.4

Update to the fixed version for your release line, for example:composer require silverstripe/framework:^4.4.4

Details

In the Versioned Files module through 2.0.3 for SilverStripe 3.x, unpublished versions of files are publicly exposed to anyone who can guess their URL. This guess could be highly informed by a basic understanding of the symbiote/silverstripe-versionedfiles source code. (Users who upgrade from SilverStripe 3.x to 4.x and had Versioned Files installed have no further need for this module, because the 4.x release has built-in versioning. However, nothing in the upgrade process automates the destruction of these insecure artefacts, nor alerts the user to the criticality of destruction.)

Is GHSA-xm6j-x342-gwq9 in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected symbiote/silverstripe-versionedfiles, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.